Ok, so the world is currently obsessed with AI (at least the digital world…) and with the latest Apple update releases we can see that LLMs have been used to help people find bugs! This is great news, finding bugs is better than not finding them!

The funny thing however is the obsession with CVE counts…. this is, honestly not a very useful metric to a defending org.. and I’ll try and explain why!

Measuring risk in volume of findings is not a good idea

I have worked with a lot of ors, like hundreds and hundreds… and if anyone follows me on twitter you will know I talk about the watermelon network model. This is where most orgs have a green outer layer (a firewall) and then a red inside (the corporate network, and even then some orgs run crazy exposures and have firewall management interfaces exposed, don’t use WAFs and do not keep their perimeter devices patched!), so basically as always ‘it depends’.

But to get to the point, inside every org there are usually thousands of ‘vulnerabilities’ in terms of CVEs etc.

If you run a vulnerability scan of basically any org you will be absolutely swamped with data!

and guess what… often loads of these vulnerabilities, are not reachable, exploitable or useful to an attacker. In fact we can use some incident kill chains to understand.

Let’s take the scenario of business email compromise. An attacker sets up a phishing website (somewhere to steal credentials) and then sends their targets an email saying their is a problem with their account and they need to reset their password. The reset password link takes the victim to a phishing page (this could be basic username and password of an AITM MFA token stealing site, but let’s stick with username/password as it’s easier). Now the persons browser did not block them, the site has microsoft branding and they user is tricked into providing their username and password, the TA then redirects them to office 365, the person then going on about their day.

The TA then logs into their mailbox, sets up inbox rules and does the Man in the Mailbox thing! (their aims here are financial so they then try and get in the path of the invoice communications etc. and ask for bank details to be changed etc)

How many of these leverage software vulnerabilities? none to my knowledge. This is all abusing a few things:

• A lack of identity plan controls
• A lack of decent network/web access fitting
• Socially engineering a victim

Not I put SE last as honestly people tend to ignore the fact you can totally prevent this with technical controls!

Now let’s look at a ransomware event, I’ll give an ‘easy route’ for the one, they vary a lot. A TA finds an exposed RDP server for GamesCorp, they brute force this server because someone forgot to apply controls. They get access to high privilege account, they log into the server, they enumerate the environment, they already have domain admin and then they log into the domain controller, backup severs and vcenter.

You may laugh, but this is from real incidents (not one, not two, many!). When they get low privilege access they often abuse services such as: Active Directory Certificate Services (ADCS) or Active Directory configurations (e.g. kerberoasting) to get a high privilege level of access.

Basically, if you can’t a network position inside maybe 70 percent of corp nets, you can normally get to GOD MODE without any software exploits.

That does not mean that software vulnerabilities are not important, they are. But measuring the volume of them doesn’t really make sense. What we need to understand is:

• What is the context?
• What is the affected component?
• What is the capability?
• Is this useful to an attacker?
• Is it in a position they can exploit?
• If they can exploit it, what is the impact of it?

Let’s think about these…. so why do people care about monthly patches so much?

I’ll tell you what’s really important here, edge devices! Think about SSLVPNs and remote code execution! Vulnerabilities in exposed services are a major issue, and patching here (and fast) is super important but also to throw something out here:

if your edge device security posture is based on luck of patching fast, you are always at risk of a major incident via a zero day. So you should consider leveraging different models, be that a change in architecture completely through to defence in depth (e.g. WAF/CDN, hardening, monitoring, patching, segmentation etc.)

Patching is not the same anymore

20+ years ago I had to package every single KB update and chain them together…. now we don’t do that. We just deploy 1 update for an OS, these include all the patches, we do this every month! But what else has changed?

We use PDNS, we have EDR… we have MDM. This stuff isn’t new, we still have lots of work in enterprises around patching, but the work is in the planning, testing, deploying and responding (if and when things go wrong).

Patch counts are not a metric I use with customers…. 1 or 10000, we still have to deploy the OS update.